Not sure if this is by design or something I am doing wrong. I have RHEL4 servers with some located in a DMZ. While changing the SSH config to disallow root logins, I have come across an issue, where if I ssh into any of the DMZ servers (as my user account), and try and either "su - root" or "sudo {command}" I get an error. (e.g. "Sorry, sudo must be setuid root." or the password is invalid for root.).
/etc/sudoers is setup correctly as it does work for non DMZ servers.
The root password is correct as I can login directly as root (without ssh locked down).

I have narrowed it down to the fact that our DMZ servers have "chattr +i /etc/passwd /etc/group /etc/shadow" and if I remove this (chattr -i ...) then sudo and su - root works.

Perhaps I don't understand what immutable means exactly, because I thought it meant these files can't be changed and I don't see how sudo or su is changing these files. Does anyone else have this issue? Is this by design? How do other people get around this? It seems like a standard thing to disallow root ssh logins.

thanks

I tried setting the "i" bit on the same files and was able to use su and sudo. Did you take the error message at it's word and check if the sudo program is suid root?

i = immutable..
brother, please remove it
chattr -i /etc/sudoers